Documentation
¶
Overview ¶
Package middleware provides HTTP authorization middleware for Warden.
Require, RequireAny and RequireAll are meant to be mounted on an embedding application's own routes (not Warden's management API, which authenticates and authorizes itself via api.API's own middleware chain).
Index ¶
- func Require(eng *warden.Engine, action, resourceType string, opts ...Option) forge.Middleware
- func RequireAll(eng *warden.Engine, checks []warden.CheckRequest, opts ...Option) forge.Middleware
- func RequireAny(eng *warden.Engine, checks []warden.CheckRequest, opts ...Option) forge.Middleware
- type Option
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Require ¶
Require enforces authorization. It resolves the subject from the request context and checks whether the subject can perform the given action on the resource type.
func RequireAll ¶
func RequireAll(eng *warden.Engine, checks []warden.CheckRequest, opts ...Option) forge.Middleware
RequireAll allows the request only if ALL checks pass.
func RequireAny ¶
func RequireAny(eng *warden.Engine, checks []warden.CheckRequest, opts ...Option) forge.Middleware
RequireAny allows the request if ANY of the checks pass.
Types ¶
type Option ¶ added in v1.7.0
type Option func(*config)
Option configures Require, RequireAny and RequireAll.
func AllowAnonymous ¶ added in v1.7.0
func AllowAnonymous() Option
AllowAnonymous lets a request with no resolvable identity through to the engine as an explicit "anonymous" user subject, instead of the default 401. Off by default: an unauthenticated caller is rejected before the engine is ever consulted, so a route can never be reached by a subject nobody actually asked for.
func WithContext ¶ added in v1.7.0
WithContext lets a caller inject extra attributes into the warden.CheckRequest.Context map built for each request, e.g. business context an ABAC policy condition might match on. fn is called once per request; a nil return is treated as no extra context.
Source Files